bgp: making enforce_first_as config handler more graceful

Right now a change to enforce-first-as will cause a hard reset of the session.  This could be much more graceful, given it is a policy change and not a session parameter change.

disabled -> enabled should trigger a rib walker that deletes all paths that fail the first-as check.
enabled -> disabled should trigger a route refresh (since we don't store unmodified routes in the adj-rib-in).